================================================================== BUG: KASAN: use-after-free in string_nocheck lib/vsprintf.c:641 [inline] BUG: KASAN: use-after-free in string+0x20f/0x2a0 lib/vsprintf.c:723 Read of size 1 at addr ffff888101d84e60 by task syz.3.470/2609 CPU: 0 PID: 2609 Comm: syz.3.470 Not tainted syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 Call Trace: __dump_stack+0x21/0x24 lib/dump_stack.c:77 dump_stack_lvl+0x1a7/0x208 lib/dump_stack.c:118 print_address_description+0x7f/0x2c0 mm/kasan/report.c:248 __kasan_report mm/kasan/report.c:435 [inline] kasan_report+0x100/0x140 mm/kasan/report.c:452 __asan_report_load1_noabort+0x14/0x20 mm/kasan/report_generic.c:306 string_nocheck lib/vsprintf.c:641 [inline] string+0x20f/0x2a0 lib/vsprintf.c:723 vsnprintf+0xec5/0x1990 lib/vsprintf.c:2689 seq_vprintf fs/seq_file.c:398 [inline] seq_printf+0x185/0x280 fs/seq_file.c:413 show_interrupts+0x921/0xa90 kernel/irq/proc.c:526 traverse+0x1f2/0x590 fs/seq_file.c:111 seq_lseek+0x13b/0x260 fs/seq_file.c:323 pde_lseek fs/proc/inode.c:283 [inline] proc_reg_llseek+0x1d6/0x2b0 fs/proc/inode.c:294 vfs_llseek fs/read_write.c:300 [inline] ksys_lseek fs/read_write.c:313 [inline] __do_sys_lseek fs/read_write.c:324 [inline] __se_sys_lseek fs/read_write.c:322 [inline] __x64_sys_lseek+0x181/0x200 fs/read_write.c:322 do_syscall_64+0x31/0x40 arch/x86/entry/common.c:46 entry_SYSCALL_64_after_hwframe+0x61/0xcb RIP: 0033:0x7f5c09abd159 Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007f5c08516028 EFLAGS: 00000246 ORIG_RAX: 0000000000000008 RAX: ffffffffffffffda RBX: 00007f5c09d44fa0 RCX: 00007f5c09abd159 RDX: 0000000000000000 RSI: 0000002000000008 RDI: 0000000000000004 RBP: 00007f5c09b5406b R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 R13: 00007f5c09d45038 R14: 00007f5c09d44fa0 R15: 00007ffdd7f2d718 Allocated by task 95: kasan_save_stack mm/kasan/common.c:38 [inline] kasan_set_track mm/kasan/common.c:45 [inline] set_alloc_info mm/kasan/common.c:430 [inline] ____kasan_kmalloc mm/kasan/common.c:509 [inline] __kasan_kmalloc+0xd4/0x100 mm/kasan/common.c:518 kasan_kmalloc include/linux/kasan.h:254 [inline] __kmalloc+0x19f/0x330 mm/slub.c:4038 kmalloc include/linux/slab.h:560 [inline] kernfs_fop_write_iter+0x152/0x400 fs/kernfs/file.c:273 call_write_iter include/linux/fs.h:2072 [inline] new_sync_write fs/read_write.c:518 [inline] vfs_write+0x770/0xd70 fs/read_write.c:605 ksys_write+0x14a/0x260 fs/read_write.c:658 __do_sys_write fs/read_write.c:670 [inline] __se_sys_write fs/read_write.c:667 [inline] __x64_sys_write+0x7b/0x90 fs/read_write.c:667 do_syscall_64+0x31/0x40 arch/x86/entry/common.c:46 entry_SYSCALL_64_after_hwframe+0x61/0xcb The buggy address belongs to the object at ffff888101d84e60 which belongs to the cache kmalloc-8 of size 8 The buggy address is located 0 bytes inside of 8-byte region [ffff888101d84e60, ffff888101d84e68) The buggy address belongs to the page: page:ffffea0004076100 refcount:1 mapcount:0 mapping:0000000000000000 index:0xffff888101d84208 pfn:0x101d84 flags: 0x4000000000000200(slab) raw: 4000000000000200 ffffea0004cb3488 ffffea00042074c8 ffff888100043c80 raw: ffff888101d84208 0000000000660040 00000001ffffffff 0000000000000000 page dumped because: kasan: bad access detected page_owner tracks the page as allocated page last allocated via order 0, migratetype Unmovable, gfp_mask 0x12cc0(GFP_KERNEL|__GFP_NOWARN|__GFP_NORETRY), pid 1, ts 1639643190, free_ts 0 set_page_owner include/linux/page_owner.h:35 [inline] post_alloc_hook mm/page_alloc.c:2456 [inline] prep_new_page+0x176/0x190 mm/page_alloc.c:2462 get_page_from_freelist+0x225f/0x23f0 mm/page_alloc.c:4254 __alloc_pages_nodemask+0x29a/0x640 mm/page_alloc.c:5384 alloc_slab_page mm/slub.c:-1 [inline] allocate_slab mm/slub.c:1813 [inline] new_slab+0x84/0x3f0 mm/slub.c:1874 new_slab_objects mm/slub.c:2632 [inline] ___slab_alloc+0x2f8/0x4c0 mm/slub.c:2796 __slab_alloc+0x63/0xa0 mm/slub.c:2836 slab_alloc_node mm/slub.c:2918 [inline] slab_alloc mm/slub.c:2960 [inline] __kmalloc_track_caller+0x1e4/0x310 mm/slub.c:4541 kstrdup mm/util.c:63 [inline] kstrdup_const+0x55/0x90 mm/util.c:86 __kernfs_new_node+0xa6/0x670 fs/kernfs/dir.c:658 kernfs_new_node+0x150/0x260 fs/kernfs/dir.c:739 kernfs_create_dir_ns+0x47/0x130 fs/kernfs/dir.c:1087 sysfs_create_dir_ns+0x128/0x290 fs/sysfs/dir.c:59 create_dir lib/kobject.c:89 [inline] kobject_add_internal+0x774/0xde0 lib/kobject.c:263 kobject_add_varg lib/kobject.c:398 [inline] kobject_init_and_add+0x128/0x190 lib/kobject.c:481 bus_add_driver+0x1da/0x560 drivers/base/bus.c:617 driver_register+0x335/0x440 drivers/base/driver.c:240 page_owner free stack trace missing Memory state around the buggy address: ffff888101d84d00: fc fc fc fc fb fc fc fc fc 00 fc fc fc fc fb fc ffff888101d84d80: fc fc fc 00 fc fc fc fc 00 fc fc fc fc 00 fc fc >ffff888101d84e00: fc fc fb fc fc fc fc 00 fc fc fc fc fb fc fc fc ^ ffff888101d84e80: fc 00 fc fc fc fc 00 fc fc fc fc 00 fc fc fc fc ffff888101d84f00: 00 fc fc fc fc fb fc fc fc fc 00 fc fc fc fc 00 ================================================================== netlink: 8 bytes leftover after parsing attributes in process `syz.3.470'. device lo entered promiscuous mode device tunl0 entered promiscuous mode device gre0 entered promiscuous mode device gretap0 entered promiscuous mode device erspan0 entered promiscuous mode device ip_vti0 entered promiscuous mode device ip6_vti0 entered promiscuous mode device sit0 entered promiscuous mode device ip6tnl0 entered promiscuous mode device ip6gre0 entered promiscuous mode device syz_tun entered promiscuous mode device ip6gretap0 entered promiscuous mode device bridge0 entered promiscuous mode device dummy0 entered promiscuous mode device veth0 entered promiscuous mode device veth1 entered promiscuous mode device wg0 entered promiscuous mode device wg1 entered promiscuous mode device wg2 entered promiscuous mode device veth0_to_bridge entered promiscuous mode device veth1_to_bridge entered promiscuous mode device veth0_to_bond entered promiscuous mode device bond_slave_0 entered promiscuous mode device veth1_to_bond entered promiscuous mode device bond_slave_1 entered promiscuous mode device veth0_to_team entered promiscuous mode device team_slave_0 entered promiscuous mode device veth1_to_team entered promiscuous mode device team_slave_1 entered promiscuous mode device veth0_to_batadv entered promiscuous mode device batadv_slave_0 entered promiscuous mode device veth1_to_batadv entered promiscuous mode device batadv_slave_1 entered promiscuous mode device xfrm0 entered promiscuous mode device veth0_to_hsr entered promiscuous mode device hsr_slave_0 entered promiscuous mode device veth1_to_hsr entered promiscuous mode device hsr_slave_1 entered promiscuous mode device veth1_virt_wifi entered promiscuous mode device veth0_virt_wifi entered promiscuous mode device veth1_vlan entered promiscuous mode device vlan0 entered promiscuous mode device vlan1 entered promiscuous mode device veth0_macvtap entered promiscuous mode device macsec0 entered promiscuous mode